Engineering Multi-Agent Tool Guardrails in Distributed .NET Microservices: Securing Autonomous Execution Beyond System Prompts

graph TD
    A[LLM Agent Tool Call Proposal] --> B[Gate 1: Static Scope & Attribute Authorization]
    B -->|Authorized| C[Gate 2: Runtime Schema & Semantic Boundary Validator]
    B -->|Unauthorized| X[Security Anomaly Alert & Trip Breaker]
    C -->|Valid Schema| D[Gate 3: Distributed State & Tenant Context Isolation]
    C -->|Invalid / Poison Payload| X
    D -->|Context Validated| E[Gate 4: Polly Resilience Pipeline & Rate Limiter]
    D -->|Tenant Mismatch| X
    E -->|Tokens Available| F[Target Microservice / RPC Execution]
    E -->|Circuit Open / Throttled| G[Graceful Fallback & Human Escalation]

using System;

namespace Centralogic.Security.AgentGuardrails;

public enum ToolRiskLevel
{
    Low = 0,
    Medium = 1,
    High = 2,
    Critical = 3
}

[AttributeUsage(AttributeTargets.Method, Inherited = false)]
public sealed class AgentToolGuardrailAttribute : Attribute
{
    public required string RequiredScope { get; init; }
    public ToolRiskLevel RiskLevel { get; init; } = ToolRiskLevel.Low;
    public double MaxFinancialValue { get; init; } = 0.0;
    public bool RequireHumanInTheLoop { get; init; } = false;
    public int RateLimitPerMinute { get; init; } = 60;
}

using System.Collections.Concurrent;
using System.Reflection;
using System.Security.Authentication;
using System.Text.Json;
using Microsoft.Extensions.AI;
using Microsoft.Extensions.Logging;
using Polly;
using Polly.CircuitBreaker;

namespace Centralogic.Security.AgentGuardrails;

public sealed class GuardrailToolDispatcher
{
    private readonly ILogger<GuardrailToolDispatcher> _logger;
    private readonly ResiliencePipeline _resiliencePipeline;
    private readonly ConcurrentDictionary<string, AgentToolMetadata> _toolRegistry = new();

    public GuardrailToolDispatcher(
        ILogger<GuardrailToolDispatcher> logger,
        ResiliencePipelineProvider<string> pipelineProvider)
    {
        _logger = logger;
        _resiliencePipeline = pipelineProvider.GetPipeline("agent-guardrail-circuit");
    }

    public void RegisterTool(AIFunction aiFunction, MethodInfo methodInfo)
    {
        var guardrail = methodInfo.GetCustomAttribute<AgentToolGuardrailAttribute>()
            ?? throw new InvalidOperationException($"Tool {methodInfo.Name} lacks mandatory [AgentToolGuardrail] contract.");

        _toolRegistry[aiFunction.Metadata.Name] = new AgentToolMetadata(aiFunction, guardrail, methodInfo);
    }

    public async ValueTask<object?> ExecuteSandboxedToolAsync(
        string toolName,
        IReadOnlyDictionary<string, object?> arguments,
        AgentSecurityContext securityContext,
        CancellationToken cancellationToken = default)
    {
        if (!_toolRegistry.TryGetValue(toolName, out var registeredTool))
        {
            _logger.LogWarning("Agent attempted to invoke unregistered tool '{ToolName}'.", toolName);
            throw new KeyNotFoundException($"Tool '{toolName}' is not registered or allowed.");
        }

        // 1. Enforce RBAC / Scope Checks against Security Context
        if (!securityContext.HasScope(registeredTool.Guardrail.RequiredScope))
        {
            _logger.LogCritical(
                "SECURITY VIOLATION: Agent Session {SessionId} lacks required scope {RequiredScope} for tool {ToolName}. Potential prompt injection.",
                securityContext.SessionId, registeredTool.Guardrail.RequiredScope, toolName);
            
            throw new AuthenticationException($"Access denied: Missing scope {registeredTool.Guardrail.RequiredScope}");
        }

        // 2. Enforce High-Risk Financial & Operational Boundaries
        if (registeredTool.Guardrail.RiskLevel >= ToolRiskLevel.High)
        {
            ValidateHighRiskParameters(registeredTool.Guardrail, arguments, securityContext);
        }

        // 3. Execute within Distributed Polly Circuit Breaker
        return await _resiliencePipeline.ExecuteAsync(async state =>
        {
            _logger.LogInformation(
                "Executing tool {ToolName} for Tenant {TenantId} [Risk: {RiskLevel}]",
                toolName, securityContext.TenantId, registeredTool.Guardrail.RiskLevel);

            // Invoking the wrapped MEAI AIFunction with verified parameters
            return await registeredTool.Function.InvokeAsync(arguments, cancellationToken);
        }, cancellationToken);
    }

    private static void ValidateHighRiskParameters(
        AgentToolGuardrailAttribute guardrail,
        IReadOnlyDictionary<string, object?> arguments,
        AgentSecurityContext securityContext)
    {
        // Check financial caps
        if (guardrail.MaxFinancialValue > 0.0 &&
            arguments.TryGetValue("amount", out var amountObj) &&
            Convert.ToDouble(amountObj) > guardrail.MaxFinancialValue)
        {
            throw new ArgumentOutOfRangeException("amount",
                $"Financial value exceeds strict guardrail threshold of {guardrail.MaxFinancialValue:C}.");
        }

        // Enforce strict multi-tenant boundary matching
        if (arguments.TryGetValue("tenantId", out var targetTenantObj) &&
            targetTenantObj?.ToString() != securityContext.TenantId)
        {
            throw new SecurityException("Cross-tenant parameter tampering detected. Tool execution aborted.");
        }
    }
}

public readonly record struct AgentToolMetadata(
    AIFunction Function,
    AgentToolGuardrailAttribute Guardrail,
    MethodInfo UnderlyingMethod
);

public readonly record struct AgentSecurityContext(
    string SessionId,
    string TenantId,
    string UserId,
    IReadOnlySet<string> GrantedScopes
)
{
    public bool HasScope(string scope) => GrantedScopes.Contains(scope);
}

using System.ComponentModel;
using Centralogic.Security.AgentGuardrails;

public sealed class EnterpriseBillingTools
{
    [AgentToolGuardrail(
        RequiredScope = "billing:refund:process",
        RiskLevel = ToolRiskLevel.Critical,
        MaxFinancialValue = 500.00,
        RequireHumanInTheLoop = true,
        RateLimitPerMinute = 10
    )]
    [Description("Processes an automated customer refund for a verified invoice. Strictly bounded by corporate financial guardrails.")]
    public async Task<RefundResult> ProcessCustomerRefundAsync(
        [Description("The verified invoice identifier")] string invoiceId,
        [Description("Refund amount in USD")] decimal amount,
        [Description("Detailed reason code for the refund")] string reasonCode,
        [Description("Target tenant identifier")] string tenantId,
        CancellationToken ct = default)
    {
        // Realistic microservice payment gateway call via MediatR / gRPC
        await Task.Delay(25, ct); // Simulating async RPC call to payment microservice

        return new RefundResult(
            TransactionId: $"TXN-{Guid.NewGuid():N}",
            InvoiceId: invoiceId,
            Amount: amount,
            ProcessedAt: DateTimeOffset.UtcNow,
            Status: "SUCCESS"
        );
    }
}

public sealed record RefundResult(
    string TransactionId,
    string InvoiceId,
    decimal Amount,
    DateTimeOffset ProcessedAt,
    string Status
);

using Microsoft.Extensions.DependencyInjection;
using Polly;
using Polly.CircuitBreaker;

public static class ResilienceConfiguration
{
    public static IServiceCollection AddAgentSecurityResilience(this IServiceCollection services)
    {
        services.AddResiliencePipeline("agent-guardrail-circuit", builder =>
        {
            builder
                .AddCircuitBreaker(new HttpCircuitBreakerStrategyOptions
                {
                    FailureRatio = 0.5,
                    SamplingDuration = TimeSpan.FromSeconds(30),
                    MinimumThroughput = 4,
                    BreakDuration = TimeSpan.FromMinutes(2),
                    ShouldHandle = new PredicateBuilder().Handle<AuthenticationException>()
                                                         .Handle<SecurityException>()
                                                         .Handle<ArgumentOutOfRangeException>()
                })
                .AddTimeout(TimeSpan.FromSeconds(5));
        });

        return services;
    }
}